CVE-2026-72119 Linux CVE debrief

Who should care

Linux kernel users, CAN bcm implementers, and cybersecurity teams responsible for maintaining Linux systems should be aware of this vulnerability and take necessary actions to prevent potential use of it. This includes verifying Linux kernel version and updating if necessary, reviewing system CAN bcm configurations for potential vulnerabilities, and implementing additional monitoring for CAN bcm related activities. Linux distributions and vendors may also need to assess and update their packages accordingly. Security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets that need extra review should be checked. Exceptions, retested remediated assets, and closed items should be tracked, with evidence documented before closure. Asset inventory and configuration management processes may require updates to account for this vulnerability. Security teams should also consider the operational impact of this vulnerability on their organization and prioritize remediation efforts accordingly. The vulnerability's impact on the organization's security posture should be assessed, and necessary measures should be taken to mitigate potential risks. This may involve coordination with Linux kernel developers, CAN bcm implementers, and other stakeholders to ensure effective mitigation and remediation of the vulnerability. Additionally, security teams should review their incident response plans to ensure they are prepared to respond to potential exploitation of this vulnerability. This includes identifying potential entry points, developing strategies for containment and eradication, and establishing communication protocols for stakeholders. By taking these steps, security teams can help prevent potential use of this vulnerability and minimize its impact on their organization. Security teams should also consider implementing additional security

Technical summary

The Linux kernel's CAN bcm implementation had a vulnerability where improper synchronization could allow for use-after-free attacks. An update has been provided to extend bcm_tx_lock usage for data and timer updates, addressing the issue. This update stages new CAN frame content for an existing tx op into a kmalloc()'d buffer and validates it there, mirroring the approach already used in bcm_rx_setup(). Only copy the validated data into op->frames while holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler() can no longer observe a partially updated or unvalidated frame. A missing error path for memcpy_from_msg() when copying CAN frame data from userspace has also been added.

Defensive priority

Linux kernel users should verify their systems are updated with the latest CAN bcm patches to prevent potential use of this vulnerability.

Recommended defensive actions

• Verify Linux kernel version and update if necessary
• Review system CAN bcm configurations for potential vulnerabilities
• Implement additional monitoring for CAN bcm related activities
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE details a vulnerability in the Linux kernel's CAN bcm implementation, where improper synchronization could allow for use-after-free attacks. An update has been provided to extend bcm_tx_lock usage for data and timer updates, addressing the issue. Linux kernel users should verify their systems are updated with the latest CAN bcm patches to prevent potential use of this vulnerability. Additional verification tasks include reviewing system CAN bcm configurations for potential vulnerabilities and implementing additional monitoring for CAN bcm related activities.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.